Daily Digest – 25 October 2026

Morning from Oslo. It is a patch weekend, with two critical bugs in PHP and Brotli now hitting far more software than first thought. Agents are also doing real performance work, and Europe is arguing about tech sovereignty again.

Tech sector

PHP2Shell is now being exploited in the wild

The two unauthenticated RCE bugs in PHP (CVE-2026-109618/109619) were patched on 21 Oct. Palo Alto Networks and Trail of Bits now report confirmed compromises, and Cloudflare says exploit attempts are climbing fast. Unit 42 also saw attackers using an agentic AI toolkit for the post-exploitation steps.

Why it matters: Plenty of Nordic municipal sites, agencies and agency-built shops still run WordPress, Drupal or Laravel. Patch the obvious servers first. Then go looking for PHP inside routers, VPN boxes and old intranets.

Source: TechCrunch · 24 Oct · Unit 42 advisory

HTTP2Shell: the Brotli bug spreads well beyond Node

The out-of-bounds write in Google's Brotli decoder (CVE-2026-111497, CVSS 9.2) also hits Python's brotli/brotlicffi. Requests, httpx and aiohttp load those automatically when they are installed. Bun, Envoy, Istio and some curl builds are affected too. The bug works both ways: a malicious server can hit a client, and a malicious client can hit a server.

Why it matters: pip-audit and Dependabot don't flag the Python packages yet, so a green dashboard can mislead you. Bump versions, rebuild container images and redeploy.

Source: Aikido · updated 24 Oct

Block's Dessa voice model runs on a MacBook

Block's research lab showed Dessa, a full-duplex speech model that listens and talks at the same time. It was trained only on human speech, without a text LLM in the loop. Block says it runs locally on an M4 Max MacBook Pro. There is no public access yet, because safety researchers are testing it for deception risks first.

Why it matters: On-device voice is easier to square with GDPR and Datatilsynet than streaming audio to a US cloud. Whether speech-only training can work for smaller languages like Norwegian is an open question.

Source: TechCrunch · 24 Oct · block.xyz/dessa

AWS says 2027 capacity is largely sold out

Andy Jassy says AWS has committed most of its 2027 capacity and kept only a small reserve for on-demand and Bedrock. It has already sold a good chunk of 2028. Amazon is spending about $220B on capex this year, much of it tied to a few AI labs.

Why it matters: If you assume you'll get on-demand GPUs in eu-north-1 next year, plan for that not happening. The Nordic data center buildout becomes more strategic, and so do the fights over its land and power use (see the Finland story below).

Source: 24/7 Wall St. · 24 Oct (Jassy podcast 23 Oct)

AI agents

Gemini 4 Argon spent 11 hours optimizing Google's agent framework

Argon worked unattended on the ADK Python codebase (about 200k lines, ~17k tests). It set baselines, proposed changes, ran the test suite and opened a single PR. Maintainers accepted two changes, event filtering and lazy imports, which cut session-prep overhead by ~40% and cold imports by 21%. They rejected four others.

Why it matters: This is a realistic picture of agent work. The wins are small and backed by tests, and human review is still the bottleneck. The repo-scoped skills files are a pattern you can copy into your own monorepo.

Source: InfoQ · 24 Oct

Kimi K3.1 Pro is close to the frontier on agentic coding, with open weights promised

Moonshot's new model has a 1M-token context. By its own count it scores 65.7% on Terminal-Bench 4.0, just behind Claude Opus 5.5 at 66.4%. A Highspeed variant runs 2–3× faster, and full weights are promised by 4 Nov. On HN (977 points, 584 comments), people argued about distillation and paid-influencer hype.

Why it matters: A near-frontier open-weight agent model could be self-hosted in an EU region, which matters for regulated Nordic companies. Wait for the weights and for independent evals before you trust the numbers.

Source: Moonshot · 23–24 Oct · HN discussion

Replit reportedly moves most of its model spend to OpenAI

According to The Information, the coding-agent company moved most of its AI spend from Anthropic to OpenAI. The deal is reportedly worth more than $100M a year.

Why it matters: Agent products don't stay loyal to one model vendor. Keep a provider abstraction and your own eval suite, so a switch takes a sprint instead of a rewrite.

Source: The Information · 24 Oct (paywalled)

Agents are moving into your text messages

TechCrunch rounds up 24 agents you use by texting them like a person, for booking, scheduling and household logistics. Instinct, which raised $1B in September, leads the category and has drawn privacy and security concerns.

Why it matters: When the interface is a chat thread, someone's agent uses your product instead of their browser. A clean, well-documented API starts to matter more than a polished UI.

Source: TechCrunch · 24 Oct

Hacker News buzz

"No signs of AI payoff outside the tech sector"

An Apollo note argues that companies outside tech show little financial return from AI so far. It was the most-discussed story of the day.

What commenters argued about: Whether it is too early (the productivity paradox, the slow spread of electrification) or a debt-fuelled bubble, and whether rate changes muddy the data.

Why it matters: Nordic boards are asking the same question. Engineers who can show measured outcomes, beyond demos, will win the budget discussions.

545 points · 566 comments · HN discussion

Steve Blank: Musk just gave Europe a reason to replace American tech

Blank uses the recent Starlink/Starshield throttling in Ukraine to argue that Europe has to own its critical tech stack. TechCrunch reported on 24 Oct that service seems back to normal.

What commenters argued about: Who really controls Starshield (Musk or the US military), and whether Europe can build alternatives. Some pointed to ICEYE, Isar and Eutelsat. Others blamed regulation and thin investment.

Why it matters: This is the same sovereignty debate as cloud and Microsoft 365 in Nordic public procurement, now with satellites and real stakes.

437 points · 468 comments · HN discussion · Starlink update

Google cleared ~250k trees in Finland for a data center without the required assessment

Finland's regulator LVV halted work at Google's Muhos and Otanmäki sites because the environmental impact assessments were not done before the clear-cutting. Google's Finland chief apologized.

What commenters argued about: Whether this is media outrage over a permitting slip in a country full of forest, or a big company skipping rules everyone else has to follow. The wider footprint of data centers also came up.

Why it matters: The Nordic data center pitch (cheap clean power, cool climate) is colliding with local politics. Expect tougher permitting for the hyperscaler regions your apps run in.

252 points · 201 comments · HN discussion · Source: Mother Jones / Guardian